Back out bug 735313, an invariant was relaxed but not all assertions of it were adjusted properly, and I'm not 100% confident tinderboxen will correctly handle the new failure mode. r=bustage

js/src/vm/StringBuffer-inl.h

@@ -13,39 +13,57 @@
 
 namespace js {
 
+inline bool
+StringBuffer::checkLength(size_t length)
+{
+    return JSString::validateLength(context(), length);
+}
+
 inline bool
 StringBuffer::reserve(size_t len)
 {
+    if (!checkLength(len))
+        return false;
     return cb.reserve(len);
 }
 
 inline bool
 StringBuffer::resize(size_t len)
 {
+    if (!checkLength(len))
+        return false;
     return cb.resize(len);
 }
 
 inline bool
 StringBuffer::append(const jschar c)
 {
+    if (!checkLength(cb.length() + 1))
+        return false;
     return cb.append(c);
 }
 
 inline bool
 StringBuffer::append(const jschar *chars, size_t len)
 {
+    if (!checkLength(cb.length() + len))
+        return false;
     return cb.append(chars, len);
 }
 
 inline bool
 StringBuffer::append(const jschar *begin, const jschar *end)
 {
+    if (!checkLength(cb.length() + (end - begin)))
+        return false;
     return cb.append(begin, end);
 }
 
 inline bool
 StringBuffer::appendN(const jschar c, size_t n)
 {
+    if (!checkLength(cb.length() + n))
+        return false;
     return cb.appendN(c, n);
 }
 

js/src/vm/StringBuffer.cpp

@@ -47,8 +47,7 @@ StringBuffer::finishString()
         return cx->runtime->atomState.emptyAtom;
 
     size_t length = cb.length();
-    if (!JSString::validateLength(cx, length))
-        return NULL;
+    JS_ASSERT(checkLength(length));
 
     JS_STATIC_ASSERT(JSShortString::MAX_SHORT_LENGTH < CharBuffer::InlineLength);
     if (JSShortString::lengthFits(length))

js/src/vm/StringBuffer.h

@@ -34,6 +34,7 @@ class StringBuffer
 
     CharBuffer cb;
 
+    inline bool checkLength(size_t length);
     JSContext *context() const { return cb.allocPolicy().context(); }
     jschar *extractWellSized();